Juniper SRX Series

Chapter 6. Transparent Mode

There are two common challenges to deploying traditional Layer 3 network firewalls into a network. The first challenge is that you typically must change the IP routing to support the new firewall into the network, which can be a particularly difficult task, especially when dealing with readdressing segments. The other challenge with traditional firewalls is that they are very weak routers, at least in terms of dynamic routing protocol support, not to mention the fact that the security teams, which managed the firewalls, are typically separate from the teams that managed the routing infrastructure.

Because the SRX runs Junos, you’re already equipped with the best routing platform there is, so routing support isn’t an issue for the SRX, even though it is for many competitive firewalls and the previous generation of ScreenOS devices.

Transparent mode essentially allows the SRX to act as a Layer 2 bridge with the added security functionality of being a stateful firewall, as well as providing additional services such as IPS and AppSecure.

Transparent Mode Overview

Fundamentally, transparent mode is very similar to Layer 3 routed mode on the SRX platform. Although there are some limitations that are discussed later in this chapter that you should be aware of when balancing the decision to deploy transparent mode, this is a feature that certainly has its place in contemporary networking. First this chapter reviews the reasons for deployment, how the technology functions, ...